Should Internal and External Domain names be the same?

[fiza]

Since before I started here the internal domain name has been "domain.schoolname.borough.sch.uk". The external domain name was "schoolname.borough.sch.uk". We have now changed the external name to "schoolname.org.uk".

 

Should I be looking at changing the internal domain name to match?

 

The reason being I am looking at configuring LDAPS for the DCs and one of the pre-reqs is that the Active Directory fully qualified domain name of the domain controller (for example, DC01.DOMAIN.COM) must appear in one of the following places:The Common Name (CN) in the Subject field. DNS entry in the Subject Alternative Name extension.

 

Looking at doing this with a Let's Encrypt SSL Certificate

 

Is there a way to do this without changing the Internal domain name or am I looking at this in completely the wrong way?

[localzuk]

Why aren't you simply using an internal CA? Are devices that don't have the ability to have a root certificate installed connecting to your AD server?

 

We have LDAPS set up - as we have an Windows CA server. No need for Lets Encrypt at all.

[fiza]

Why aren't you simply using an internal CA? Are devices that don't have the ability to have a root certificate installed connecting to your AD server?

 

We have LDAPS set up - as we have an Windows CA server. No need for Lets Encrypt at all.

 

We are using external services (Room Booking System and Parents Evening System) where I want to use LDAPS to authenticate users. Can I still use an internal CA for these?

[FN-GM]

We are using external services (Room Booking System and Parents Evening System) where I want to use LDAPS to authenticate users. Can I still use an internal CA for these?

 

Sorry to hijack. If you have Office 365 it and have it synced with AD it will probably be more secure to do the LDAPS against Azure AD than your internal domain controllers.

[fiza]

Sorry to hijack. If you have Office 365 it and have it synced with AD it will probably be more secure to do the LDAPS against Azure AD than your internal domain controllers.

 

Unfortunately no Office 365 here. We are Google Workspace users.

[DavidYoung]

Unfortunately no Office 365 here. We are Google Workspace users.

 

You can do LDAPS against Google Workspace, but if you are talking about School Cloud systems then we have them set up with SAML against G Suite which would be much easier to configure than LDAPS against AD as it doesn't require firewall access to your DCs and is more secure as Google handles the authentication and it is proper SSO as long as the teacher is authenticated in Google first.

[fiza]

You can do LDAPS against Google Workspace, but if you are talking about School Cloud systems then we have them set up with SAML against G Suite which would be much easier to configure than LDAPS against AD as it doesn't require firewall access to your DCs and is more secure as Google handles the authentication and it is proper SSO as long as the teacher is authenticated in Google first.

 

It is School Cloud Systems. Will have a look at SAML. Thanks

[DavidYoung]

It is School Cloud Systems. Will have a look at SAML. Thanks

 

https://support.parentseveningsystem.co.uk/article/444-g-suite-how-to-configure-teacher-logins

[fiza]

https://support.parentseveningsystem.co.uk/article/444-g-suite-how-to-configure-teacher-logins

 

Had a look at the info at that link.

 

What did you do for the MetaData URL?

 

While this propagation occurs, add the metadata file you downloaded in step 5 to a web accessible directory - i.e. a directory that is open to access via the internet from the IP addresses of our servers. If you do not have such a directory available to you we would suggest you try a web search for a provider using "direct link file hosting" or a similar query. Please note that Google Drive doesn't work for hosting metadata.

[DavidYoung]

What did you do for the MetaData URL?

 

It frustrated us, I did try Google drive with a direct download link but it didn't work. In the end I set up a GitLab account (I think Github would also work) and used their static pages feature to host the file.

[localzuk]

Could you not host it on your school website?

[fiza]

Could you not host it on your school website?

We are looking at that